var-200901-0748
Vulnerability from variot
Use-after-free vulnerability in the JavaScript DOM implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by destroying a document.body element that has an unspecified XML container with elements that support the dir attribute. This vulnerability allows attackers to execute arbitrary code on vulnerable software utilizing the Apple WebKit library. User interaction is required to exploit this vulnerability in that the target must visit a malicious page.The specific flaw exists when the document.body element contains a specific XML container containing various elements supporting the 'dir' attribute. During the destruction of this element, if the rendering object responsible for the element is being removed, the application will then make a call to a method for an object that doesn't exist which can lead to code execution under the context of the current user. WebKit is prone to a remote code-execution vulnerability. Failed exploit attempts will result in a denial-of-service condition. NOTE: This issue was previously covered in BID 35260 (Apple Safari Prior to 4.0 Multiple Security Vulnerabilities), but has been assigned its own record to better document it. These issues affect versions prior to Safari 4.0 running on Apple Mac OS X 10.4.11 and 10.5.7, Windows XP, and Windows Vista. NOTE: This BID is being retired because the following individual records have been created to better document issues previously mentioned in this BID: 35321 WebKit XML External Entity Information Disclosure Vulnerability 35320 WebKit HTML 5 Standard Method Cross Site Scripting Vulnerability 35325 WebKit JavaScript DOM User After Free Remote Code Execution Vulnerability 35322 WebKit 'Canvas' HTML Element Image Capture Remote Information Disclosure Vulnerability 35319 WebKit 'document.implementation' Cross Domain Scripting Vulnerability 35271 WebKit DOM Event Handler Remote Memory Corruption Vulnerability 35317 WebKit Subframe Click Jacking Vulnerability 35318 WebKit CSS 'Attr' Function Remote Code Execution Vulnerability 35315 WebKit JavaScript 'onload()' Event Cross Domain Scripting Vulnerability 35310 WebKit 'Attr' DOM Objects Remote Code Execution Vulnerability 35311 WebKit JavaScript Exception Handling Remote Code Execution Vulnerability 35283 WebKit XSLT Redirects Remote Information Disclosure Vulnerability 35284 WebKit 'Document()' Function Remote Information Disclosure Vulnerability 35309 WebKit JavaScript Garbage Collector Memory Corruption Vulnerability 35270 WebKit 'XMLHttpRequest' HTTP Response Splitting Vulnerability 35272 WebKit Drag Event Remote Information Disclosure Vulnerability 35308 Apple Safari CoreGraphics TrueType Font Handling Remote Code Execution Vulnerability 33276 Multiple Browser JavaScript Engine 'Math.Random()' Cross Domain Information Disclosure Vulnerability 35352 Apple Safari for Windows Reset Password Information Disclosure Vulnerability 35346 Apple Safari for Windows Private Browsing Cookie Data Local Information Disclosure Vulnerability 35353 Safari X.509 Extended Validation Certificate Revocation Security Bypass Vulnerability 35350 WebKit Java Applet Remote Code Execution Vulnerability 35340 WebKit Custom Cursor and Adjusting CSS3 Hotspot Properties Browser UI Element Spoofing Vulnerability 35348 WebKit Web Inspector Cross Site Scripting Vulnerability 35349 WebKit Web Inspector Page Privilege Cross Domain Scripting Vulnerability 35351 Apple Safari 'open-help-anchor' URI Handler Remote Code Execution Vulnerability 35334 WebKit SVG Animation Elements User After Free Remote Code Execution Vulnerability 35333 WebKit File Enumeration Information Disclosure Vulnerability 35327 WebKit 'Location' and 'History' Objects Cross Site Scripting Vulnerability 35332 WebKit 'about:blank' Security Bypass Vulnerability 35330 WebKit JavaScript Prototypes Cross Site Scripting Vulnerability 35331 WebKit 'Canvas' SVG Image Capture Remote Information Disclosure Vulnerability 35328 WebKit Frame Transition Cross Domain Scripting Vulnerability 35339 Apple Safari Windows Installer Local Privilege Escalation Vulnerability 35344 Apple Safari CFNetwork Script Injection Weakness 35347 Apple Safari CFNetwork Downloaded Files Information Disclosure Vulnerability. Safari is the web browser bundled by default in the Apple family machine operating system. A use-after-free vulnerability exists in Apple Safari's \"WebKit\" handling of the JavaScript DOM.
-- Vendor Response: Apple has issued an update to correct this vulnerability. More details can be found at:
http://support.apple.com/kb/HT3613
-- Disclosure Timeline: 2009-02-09 - Vulnerability reported to vendor 2009-06-08 - Coordinated public release of advisory
-- Credit: This vulnerability was discovered by: * wushi & ling of team509
-- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is used. TippingPoint does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
. ----------------------------------------------------------------------
Do you have VARM strategy implemented?
(Vulnerability Assessment Remediation Management)
If not, then implement it through the most reliable vulnerability intelligence source on the market.
Implement it through Secunia.
For more information visit: http://secunia.com/advisories/business_solutions/
Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com
TITLE: Apple Safari Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA35379
VERIFY ADVISORY: http://secunia.com/advisories/35379/
DESCRIPTION: Some vulnerabilities have been reported in Apple Safari, which can be exploited by malicious people to disclose sensitive information or compromise a user's system.
1) An error in the handling of TrueType fonts can be exploited to corrupt memory when a user visits a web site embedding a specially crafted font.
2) Some vulnerabilities in FreeType can potentially be exploited to compromise a user's system.
For more information: SA34723
3) Some vulnerabilities in libpng can potentially be exploited to compromise a user's system.
For more information: SA33970
4) An error in the processing of external entities in XML files can be exploited to read files from the user's system when a users visits a specially crafted web page.
Other vulnerabilities have also been reported of which some may also affect Safari version 3.x.
SOLUTION: Upgrade to Safari version 4, which fixes the vulnerabilities.
PROVIDED AND/OR DISCOVERED BY: 1-3) Tavis Ormandy 4) Chris Evans of Google Inc.
ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT3613
Chris Evans: http://scary.beasts.org/security/CESA-2009-006.html
OTHER REFERENCES: SA33970: http://secunia.com/advisories/33970/
SA34723: http://secunia.com/advisories/34723/
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. ----------------------------------------------------------------------
Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM).
Request a free trial: http://secunia.com/products/corporate/vim/
TITLE: SUSE update for Multiple Packages
SECUNIA ADVISORY ID: SA43068
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/43068/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=43068
RELEASE DATE: 2011-01-25
DISCUSS ADVISORY: http://secunia.com/advisories/43068/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/43068/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=43068
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: SUSE has issued an update for multiple packages, which fixes multiple vulnerabilities.
For more information: SA32349 SA33495 SA35095 SA35379 SA35411 SA35449 SA35758 SA36269 SA36677 SA37273 SA37346 SA37769 SA38061 SA38545 SA38932 SA39029 SA39091 SA39384 SA39661 SA39937 SA40002 SA40072 SA40105 SA40112 SA40148 SA40196 SA40257 SA40664 SA40783 SA41014 SA41085 SA41242 SA41328 SA41390 SA41443 SA41535 SA41841 SA41888 SA41968 SA42151 SA42264 SA42290 SA42312 SA42443 SA42461 SA42658 SA42769 SA42886 SA42956 SA43053
SOLUTION: Apply updated packages via YaST Online Update or the SUSE FTP server
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200901-0748",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "safari",
"scope": "eq",
"trust": 2.2,
"vendor": "apple",
"version": "3.1.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 2.2,
"vendor": "apple",
"version": "3.1.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "2.0.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "2.0.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "2.0.4"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "2.0.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "3.0.3b"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "3.1.0b"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "3.0.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "3.0.4"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "3.1.0"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "3.2.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "3.2.0"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "3.0.4b"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "1.1.0"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "1.0.0"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "1.1.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "3.0"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "3.0.0"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "3.0.2b"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "1.1.5"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "2.1.1"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "1.0.2"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "2.0.1"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "*"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "3.0.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "3.0.0b"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "3.0.1b"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "2.0"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "*"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "2.0"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "2.1"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "2.0.2"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "2.2.1"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "1.1.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "2.0.0"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "1.1.3"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "2.0.0"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "2.2"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "1.0.1"
},
{
"model": "safari",
"scope": "lte",
"trust": 1.0,
"vendor": "apple",
"version": "3.2.2"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "1.1.4"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "3.0.1"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.4.11"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.5.7"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.4.11"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.5.7"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "1.0 to 2.2.1"
},
{
"model": "ios for ipod touch",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "1.1 to 2.2.1"
},
{
"model": "safari",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "4.0"
},
{
"model": "safari",
"scope": null,
"trust": 0.7,
"vendor": "apple",
"version": null
},
{
"model": "safari beta for windows",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3"
},
{
"model": "safari for windows",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.1.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "1.2.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.1"
},
{
"model": "safari for windows",
"scope": "ne",
"trust": 0.6,
"vendor": "apple",
"version": "4"
},
{
"model": "safari for windows",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.1.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "1.0"
},
{
"model": "safari beta for windows",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.0.1"
},
{
"model": "safari for windows",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "1.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "1.2.1"
},
{
"model": "safari beta",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.0.2"
},
{
"model": "safari beta",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "2"
},
{
"model": "safari for windows",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.2.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.2"
},
{
"model": "safari beta for windows",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.0.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "1.2.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "1.1"
},
{
"model": "safari beta",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "4"
},
{
"model": "safari beta for windows",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.0.4"
},
{
"model": "safari beta",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.2.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "1.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "1.3.1"
},
{
"model": "safari beta for windows",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.0.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "1.3.2"
},
{
"model": "safari beta",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.0.1"
},
{
"model": "safari for windows",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.2.3"
},
{
"model": "safari",
"scope": "ne",
"trust": 0.6,
"vendor": "apple",
"version": "4"
},
{
"model": "safari for windows",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.2.1"
},
{
"model": "safari beta",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "3.0.3"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.2"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.4"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0"
},
{
"model": "ipod touch",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "3.0"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.2"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.2"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.2"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.3"
},
{
"model": "iphone",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "3.0"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.0.2"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.2.1"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.2"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.2.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.3"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "0"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.1"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.2"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.0.1"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.1"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.1"
},
{
"model": "open source project webkit",
"scope": "eq",
"trust": 0.3,
"vendor": "webkit",
"version": "0"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.4"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-09-033"
},
{
"db": "BID",
"id": "35325"
},
{
"db": "BID",
"id": "35260"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001776"
},
{
"db": "CNNVD",
"id": "CNNVD-200906-185"
},
{
"db": "NVD",
"id": "CVE-2009-1701"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:apple:mac_os_x",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:mac_os_x_server",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:iphone_os",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:iphone_os_for_ipod_touch",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:apple:safari",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-001776"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "wushi\u0026ling of team509",
"sources": [
{
"db": "ZDI",
"id": "ZDI-09-033"
}
],
"trust": 0.7
},
"cve": "CVE-2009-1701",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "CVE-2009-1701",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-39147",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2009-1701",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2009-1701",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-200906-185",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-39147",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-39147"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001776"
},
{
"db": "CNNVD",
"id": "CNNVD-200906-185"
},
{
"db": "NVD",
"id": "CVE-2009-1701"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Use-after-free vulnerability in the JavaScript DOM implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by destroying a document.body element that has an unspecified XML container with elements that support the dir attribute. This vulnerability allows attackers to execute arbitrary code on vulnerable software utilizing the Apple WebKit library. User interaction is required to exploit this vulnerability in that the target must visit a malicious page.The specific flaw exists when the document.body element contains a specific XML container containing various elements supporting the \u0027dir\u0027 attribute. During the destruction of this element, if the rendering object responsible for the element is being removed, the application will then make a call to a method for an object that doesn\u0027t exist which can lead to code execution under the context of the current user. WebKit is prone to a remote code-execution vulnerability. Failed exploit attempts will result in a denial-of-service condition. \nNOTE: This issue was previously covered in BID 35260 (Apple Safari Prior to 4.0 Multiple Security Vulnerabilities), but has been assigned its own record to better document it. These issues affect versions prior to Safari 4.0 running on Apple Mac OS X 10.4.11 and 10.5.7, Windows XP, and Windows Vista. \nNOTE: This BID is being retired because the following individual records have been created to better document issues previously mentioned in this BID:\n35321 WebKit XML External Entity Information Disclosure Vulnerability\n35320 WebKit HTML 5 Standard Method Cross Site Scripting Vulnerability\n35325 WebKit JavaScript DOM User After Free Remote Code Execution Vulnerability\n35322 WebKit \u0027Canvas\u0027 HTML Element Image Capture Remote Information Disclosure Vulnerability\n35319 WebKit \u0027document.implementation\u0027 Cross Domain Scripting Vulnerability\n35271 WebKit DOM Event Handler Remote Memory Corruption Vulnerability\n35317 WebKit Subframe Click Jacking Vulnerability\n35318 WebKit CSS \u0027Attr\u0027 Function Remote Code Execution Vulnerability\n35315 WebKit JavaScript \u0027onload()\u0027 Event Cross Domain Scripting Vulnerability\n35310 WebKit \u0027Attr\u0027 DOM Objects Remote Code Execution Vulnerability\n35311 WebKit JavaScript Exception Handling Remote Code Execution Vulnerability\n35283 WebKit XSLT Redirects Remote Information Disclosure Vulnerability\n35284 WebKit \u0027Document()\u0027 Function Remote Information Disclosure Vulnerability\n35309 WebKit JavaScript Garbage Collector Memory Corruption Vulnerability\n35270 WebKit \u0027XMLHttpRequest\u0027 HTTP Response Splitting Vulnerability\n35272 WebKit Drag Event Remote Information Disclosure Vulnerability\n35308 Apple Safari CoreGraphics TrueType Font Handling Remote Code Execution Vulnerability\n33276 Multiple Browser JavaScript Engine \u0027Math.Random()\u0027 Cross Domain Information Disclosure Vulnerability\n35352 Apple Safari for Windows Reset Password Information Disclosure Vulnerability\n35346 Apple Safari for Windows Private Browsing Cookie Data Local Information Disclosure Vulnerability\n35353 Safari X.509 Extended Validation Certificate Revocation Security Bypass Vulnerability\n35350 WebKit Java Applet Remote Code Execution Vulnerability\n35340 WebKit Custom Cursor and Adjusting CSS3 Hotspot Properties Browser UI Element Spoofing Vulnerability\n35348 WebKit Web Inspector Cross Site Scripting Vulnerability\n35349 WebKit Web Inspector Page Privilege Cross Domain Scripting Vulnerability\n35351 Apple Safari \u0027open-help-anchor\u0027 URI Handler Remote Code Execution Vulnerability\n35334 WebKit SVG Animation Elements User After Free Remote Code Execution Vulnerability\n35333 WebKit File Enumeration Information Disclosure Vulnerability\n35327 WebKit \u0027Location\u0027 and \u0027History\u0027 Objects Cross Site Scripting Vulnerability\n35332 WebKit \u0027about:blank\u0027 Security Bypass Vulnerability\n35330 WebKit JavaScript Prototypes Cross Site Scripting Vulnerability\n35331 WebKit \u0027Canvas\u0027 SVG Image Capture Remote Information Disclosure Vulnerability\n35328 WebKit Frame Transition Cross Domain Scripting Vulnerability\n35339 Apple Safari Windows Installer Local Privilege Escalation Vulnerability\n35344 Apple Safari CFNetwork Script Injection Weakness\n35347 Apple Safari CFNetwork Downloaded Files Information Disclosure Vulnerability. Safari is the web browser bundled by default in the Apple family machine operating system. A use-after-free vulnerability exists in Apple Safari\u0027s \\\"WebKit\\\" handling of the JavaScript DOM. \n\n-- Vendor Response:\nApple has issued an update to correct this vulnerability. More\ndetails can be found at:\n\nhttp://support.apple.com/kb/HT3613\n\n-- Disclosure Timeline:\n2009-02-09 - Vulnerability reported to vendor\n2009-06-08 - Coordinated public release of advisory\n\n-- Credit:\nThis vulnerability was discovered by:\n * wushi \u0026 ling of team509\n\n-- About the Zero Day Initiative (ZDI):\nEstablished by TippingPoint, The Zero Day Initiative (ZDI) represents\na best-of-breed model for rewarding security researchers for responsibly\ndisclosing discovered vulnerabilities. \n\nResearchers interested in getting paid for their security research\nthrough the ZDI can find more information and sign-up at:\n\n http://www.zerodayinitiative.com\n\nThe ZDI is unique in how the acquired vulnerability information is\nused. TippingPoint does not re-sell the vulnerability details or any\nexploit code. Instead, upon notifying the affected product vendor,\nTippingPoint provides its customers with zero day protection through\nits intrusion prevention technology. Explicit details regarding the\nspecifics of the vulnerability are not exposed to any parties until\nan official vendor patch is publicly available. Furthermore, with the\naltruistic aim of helping to secure a broader user base, TippingPoint\nprovides this vulnerability information confidentially to security\nvendors (including competitors) who have a vulnerability protection or\nmitigation product. \n\nOur vulnerability disclosure policy is available online at:\n\n http://www.zerodayinitiative.com/advisories/disclosure_policy/\n. ----------------------------------------------------------------------\n\nDo you have VARM strategy implemented?\n\n(Vulnerability Assessment Remediation Management) \n\nIf not, then implement it through the most reliable vulnerability\nintelligence source on the market. \n\nImplement it through Secunia. \n\nFor more information visit:\nhttp://secunia.com/advisories/business_solutions/\n\nAlternatively request a call from a Secunia representative today to\ndiscuss how we can help you with our capabilities contact us at:\nsales@secunia.com\n\n----------------------------------------------------------------------\n\nTITLE:\nApple Safari Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA35379\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/35379/\n\nDESCRIPTION:\nSome vulnerabilities have been reported in Apple Safari, which can be\nexploited by malicious people to disclose sensitive information or\ncompromise a user\u0027s system. \n\n1) An error in the handling of TrueType fonts can be exploited to\ncorrupt memory when a user visits a web site embedding a specially\ncrafted font. \n\n2) Some vulnerabilities in FreeType can potentially be exploited to\ncompromise a user\u0027s system. \n\nFor more information:\nSA34723\n\n3) Some vulnerabilities in libpng can potentially be exploited to\ncompromise a user\u0027s system. \n\nFor more information:\nSA33970\n\n4) An error in the processing of external entities in XML files can\nbe exploited to read files from the user\u0027s system when a users visits\na specially crafted web page. \n\nOther vulnerabilities have also been reported of which some may also\naffect Safari version 3.x. \n\nSOLUTION:\nUpgrade to Safari version 4, which fixes the vulnerabilities. \n\nPROVIDED AND/OR DISCOVERED BY:\n1-3) Tavis Ormandy\n4) Chris Evans of Google Inc. \n\nORIGINAL ADVISORY:\nApple:\nhttp://support.apple.com/kb/HT3613\n\nChris Evans:\nhttp://scary.beasts.org/security/CESA-2009-006.html\n\nOTHER REFERENCES:\nSA33970:\nhttp://secunia.com/advisories/33970/\n\nSA34723:\nhttp://secunia.com/advisories/34723/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. ----------------------------------------------------------------------\n\n\nSecure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). \n\nRequest a free trial: \nhttp://secunia.com/products/corporate/vim/\n\n\n----------------------------------------------------------------------\n\nTITLE:\nSUSE update for Multiple Packages\n\nSECUNIA ADVISORY ID:\nSA43068\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/43068/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=43068\n\nRELEASE DATE:\n2011-01-25\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/43068/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/43068/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=43068\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nSUSE has issued an update for multiple packages, which fixes multiple\nvulnerabilities. \n\nFor more information:\nSA32349\nSA33495\nSA35095\nSA35379\nSA35411\nSA35449\nSA35758\nSA36269\nSA36677\nSA37273\nSA37346\nSA37769\nSA38061\nSA38545\nSA38932\nSA39029\nSA39091\nSA39384\nSA39661\nSA39937\nSA40002\nSA40072\nSA40105\nSA40112\nSA40148\nSA40196\nSA40257\nSA40664\nSA40783\nSA41014\nSA41085\nSA41242\nSA41328\nSA41390\nSA41443\nSA41535\nSA41841\nSA41888\nSA41968\nSA42151\nSA42264\nSA42290\nSA42312\nSA42443\nSA42461\nSA42658\nSA42769\nSA42886\nSA42956\nSA43053\n\nSOLUTION:\nApply updated packages via YaST Online Update or the SUSE FTP server",
"sources": [
{
"db": "NVD",
"id": "CVE-2009-1701"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001776"
},
{
"db": "ZDI",
"id": "ZDI-09-033"
},
{
"db": "BID",
"id": "35325"
},
{
"db": "BID",
"id": "35260"
},
{
"db": "VULHUB",
"id": "VHN-39147"
},
{
"db": "PACKETSTORM",
"id": "78172"
},
{
"db": "PACKETSTORM",
"id": "78192"
},
{
"db": "PACKETSTORM",
"id": "97846"
}
],
"trust": 3.15
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-39147",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-39147"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2009-1701",
"trust": 3.6
},
{
"db": "ZDI",
"id": "ZDI-09-033",
"trust": 3.1
},
{
"db": "BID",
"id": "35325",
"trust": 2.8
},
{
"db": "SECUNIA",
"id": "35379",
"trust": 2.6
},
{
"db": "VUPEN",
"id": "ADV-2009-1522",
"trust": 2.5
},
{
"db": "VUPEN",
"id": "ADV-2009-1621",
"trust": 2.5
},
{
"db": "OSVDB",
"id": "55008",
"trust": 2.5
},
{
"db": "SECTRACK",
"id": "1022345",
"trust": 2.5
},
{
"db": "BID",
"id": "35260",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "43068",
"trust": 1.8
},
{
"db": "VUPEN",
"id": "ADV-2011-0212",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001776",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-430",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-200906-185",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-09-034",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "78172",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-39147",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "78192",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "97846",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-09-033"
},
{
"db": "VULHUB",
"id": "VHN-39147"
},
{
"db": "BID",
"id": "35325"
},
{
"db": "BID",
"id": "35260"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001776"
},
{
"db": "PACKETSTORM",
"id": "78172"
},
{
"db": "PACKETSTORM",
"id": "78192"
},
{
"db": "PACKETSTORM",
"id": "97846"
},
{
"db": "CNNVD",
"id": "CNNVD-200906-185"
},
{
"db": "NVD",
"id": "CVE-2009-1701"
}
]
},
"id": "VAR-200901-0748",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-39147"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T20:18:20.359000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HT3613",
"trust": 1.5,
"url": "http://support.apple.com/kb/HT3613"
},
{
"title": "HT3639",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT3639"
},
{
"title": "HT3639",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT3639?viewlocale=ja_JP"
},
{
"title": "HT3613",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT3613?viewlocale=ja_JP"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-09-033"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001776"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-399",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-39147"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001776"
},
{
"db": "NVD",
"id": "CVE-2009-1701"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "http://support.apple.com/kb/ht3613"
},
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/35325"
},
{
"trust": 2.5,
"url": "http://osvdb.org/55008"
},
{
"trust": 2.5,
"url": "http://securitytracker.com/id?1022345"
},
{
"trust": 2.5,
"url": "http://secunia.com/advisories/35379"
},
{
"trust": 2.5,
"url": "http://www.vupen.com/english/advisories/2009/1522"
},
{
"trust": 2.5,
"url": "http://www.vupen.com/english/advisories/2009/1621"
},
{
"trust": 2.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-09-033/"
},
{
"trust": 1.8,
"url": "http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2009/jun/msg00005.html"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/35260"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/archive/1/504172/100/0/threaded"
},
{
"trust": 1.7,
"url": "http://support.apple.com/kb/ht3639"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/43068"
},
{
"trust": 1.7,
"url": "http://www.vupen.com/english/advisories/2011/0212"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-1701"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-1701"
},
{
"trust": 0.6,
"url": "http://www.apple.com/safari/"
},
{
"trust": 0.6,
"url": "http://www.zerodayinitiative.com/advisories/zdi-09-034/"
},
{
"trust": 0.4,
"url": "http://scary.beasts.org/security/cesa-2009-006.html"
},
{
"trust": 0.3,
"url": "http://webkit.org/"
},
{
"trust": 0.3,
"url": "http://scarybeastsecurity.blogspot.com/2009/06/apples-safari-4-fixes-local-file-theft.html"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/disclosure_policy/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-09-033"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2009-1701"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/35379/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/33970/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/34723/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/business_solutions/"
},
{
"trust": 0.1,
"url": "http://secunia.com/products/corporate/evm/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=43068"
},
{
"trust": 0.1,
"url": "http://secunia.com/products/corporate/vim/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/43068/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/43068/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-09-033"
},
{
"db": "VULHUB",
"id": "VHN-39147"
},
{
"db": "BID",
"id": "35325"
},
{
"db": "BID",
"id": "35260"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001776"
},
{
"db": "PACKETSTORM",
"id": "78172"
},
{
"db": "PACKETSTORM",
"id": "78192"
},
{
"db": "PACKETSTORM",
"id": "97846"
},
{
"db": "CNNVD",
"id": "CNNVD-200906-185"
},
{
"db": "NVD",
"id": "CVE-2009-1701"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-09-033"
},
{
"db": "VULHUB",
"id": "VHN-39147"
},
{
"db": "BID",
"id": "35325"
},
{
"db": "BID",
"id": "35260"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-001776"
},
{
"db": "PACKETSTORM",
"id": "78172"
},
{
"db": "PACKETSTORM",
"id": "78192"
},
{
"db": "PACKETSTORM",
"id": "97846"
},
{
"db": "CNNVD",
"id": "CNNVD-200906-185"
},
{
"db": "NVD",
"id": "CVE-2009-1701"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2009-06-08T00:00:00",
"db": "ZDI",
"id": "ZDI-09-033"
},
{
"date": "2009-06-10T00:00:00",
"db": "VULHUB",
"id": "VHN-39147"
},
{
"date": "2009-06-08T00:00:00",
"db": "BID",
"id": "35325"
},
{
"date": "2009-06-08T00:00:00",
"db": "BID",
"id": "35260"
},
{
"date": "2009-07-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2009-001776"
},
{
"date": "2009-06-09T18:51:50",
"db": "PACKETSTORM",
"id": "78172"
},
{
"date": "2009-06-10T12:30:42",
"db": "PACKETSTORM",
"id": "78192"
},
{
"date": "2011-01-25T03:59:20",
"db": "PACKETSTORM",
"id": "97846"
},
{
"date": "2009-01-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200906-185"
},
{
"date": "2009-06-10T18:00:00.563000",
"db": "NVD",
"id": "CVE-2009-1701"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2009-06-08T00:00:00",
"db": "ZDI",
"id": "ZDI-09-033"
},
{
"date": "2018-10-10T00:00:00",
"db": "VULHUB",
"id": "VHN-39147"
},
{
"date": "2009-06-17T23:20:00",
"db": "BID",
"id": "35325"
},
{
"date": "2009-06-12T22:19:00",
"db": "BID",
"id": "35260"
},
{
"date": "2009-07-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2009-001776"
},
{
"date": "2022-08-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200906-185"
},
{
"date": "2024-11-21T01:03:08.170000",
"db": "NVD",
"id": "CVE-2009-1701"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "35325"
},
{
"db": "BID",
"id": "35260"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Apple In product JavaScript DOM Vulnerability to execute arbitrary code related to implementation",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-001776"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unknown",
"sources": [
{
"db": "BID",
"id": "35325"
},
{
"db": "BID",
"id": "35260"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.